Security is a crucial aspect in today's mobile communication systems. For example, the security design of Long Term Evolution (LTE) provides compartmentalization. The compartmentalization mainly consists of ensuring that if an attacker breaks the security of one function, only that function is compromised. For example, there is one key used for encryption of the Radio Resource Control (RRC) protocol and another key used for integrity protection of the RRC protocol. RRC is a signaling protocol which uses lower layers for segmentation and reliable in-order delivery of signaling messages. RRC is suitable for messages of any size requiring reliable delivery such as user equipment (UE) configuration. In LTE and LTE-advanced (LTE-a), RRC is involved in the Non-Access Stratum (NAS) message exchange between a UE and a Mobility Management Entity (MME) as well as to provide various control-plane functions both on the UE and the evolved NodeB (eNodeB or in short eNB).
Access Stratum (AS) security is comprised of integrity protection of control plane (i.e., RRC signalling) and the ciphering of both the control and user planes. If an attacker breaks the RRC encryption key, the attacker can decrypt and read all RRC messages. However, since the integrity key is different from the encryption key, the attacker cannot modify or inject RRC messages. Neither can an attacker that has broken the RRC encryption key use that to eavesdrop on Data Radio Bearers (DRBs) since they use separate encryption keys (and vice versa). Another part of the compartmentalization design is that each eNB uses a separate set of keys. The rationale is that this ensures that an attacker breaking in to one eNB does not gain any information about data transmitted between a UE and another physically different eNB. To maintain the property that breaking into one physical Radio Access Network (RAN) node, i.e., an eNB, does not help in attacking another RAN node, the assisting eNB should use its own key set separate from the key set used in the anchor eNB, however it can be derived from the anchor eNB as in LTE dual connectivity.
Typically, when a new Radio Access Technology (RAT) is standardized, this is done by also introducing a separate Core Network catering for that RAT and 3GPP introduces mechanisms to move from one RAT to another RAT with minimal service interruption via the Core Network. Hence, in any case, moving from one RAT to another RAT means establishing a RRC connection towards the target RAT and removing the RRC connection from the source RAT, and because those RRC connections terminate in different logical nodes anchoring in different Core Networks (i.e., are completely separate UE connections), there is no possibility of synergy between them.
Signaling bearer and/or data bearer establishment and/or signaling bearer and/or data bearer recovery requires a number of signaling steps, resulting in e.g. signaling overhead and/or long signaling duration. Current signaling procedures for security context setup have not been designed or at least optimized to support a RAN architecture which is comprised of multiple air interfaces as in multi-RAT networks. This is even the case when the first RAT and second RAT connections of the UE would be toward the same, or in other words, a shared radio node and/or core network node.
Still further, security context may be different for different RATs (despite the tight integration) or standard releases or UE capabilities or device categories. For example, there may be different length requirements for the security keys of different RATs or the network termination may be in separate nodes, requiring separate sets of keys.